FL-Forensics: A Forensic-Ready Framework for Tamper-Evident Accountability and Auditability in Federated Learning

Federated learning (FL) trains shared models without centralizing raw data, but provides limited post-incident accountability or evidence preservation. We present FL-Forensics, a Flower extension for malicious-client and compromised-aggregator settings. Client-signed commitments are witnessed before server acceptance and later anchored, in a simulated four-validator quorum, for independent verification. We define a Forensic Quality Index (FQI) that combines evidence quality, attribution quality, and detection F1. In experiments with 20 clients, Dirichlet non-IID data, and 15% malicious clients, F1 on MNIST, Fashion-MNIST, and CIFAR-100 is 0.950, 0.873, and 0.660, with corresponding FQI values of 0.964, 0.929, and 0.815 (the MNIST and Fashion-MNIST values are means over two runs; the CIFAR-100 values are from one run). Detection weakens as the federation grows to 60 clients and against adaptive or colluding attackers, and Trimmed Mean, Krum, or FLTrust matches or exceeds it in some settings, so the contribution is the evidence layer rather than superior detection. Across six repeated tampering runs of 132 trials each, all eight manipulation types were detected and recovered; in the reported CIFAR-100 run, responsible-party attribution succeeded in 87/132 trials across five of the eight types. A counterfactual ablation on captured evidence illustrates the role of the independent witness; it is not an end-to-end ablation. Under secure aggregation, commitments remain verifiable but in-round screening is largely unavailable; post-incident content attribution requires auditor escrow, which exposes individual updates to an authorized auditor. Secure aggregation is simulated, and end-to-end overhead against a matched baseline is not reported.